Detecting human attacks on text‐based CAPTCHAs using the keystroke dynamic approach

Abstract

A Completely Automated Public Turing Test to Tell Computers and Humans Apart (CAPTCHA) is a simple test that is used on websites to differentiate between human users and automated attacks that indulge in spamming and other fraudulent activities. A text-based CAPTCHA is the most popular security technique used by many websites on the Internet, such as Microsoft, Google and eBay, to secure their sites from automated attacks. By design, however, a CAPTCHA is unable to differentiate between a legitimate human user and a human-based attacker. This may make websites vulnerable to human-based attacks while using CAPTCHAs. Hence this article proposes a novel defence system using the keystroke dynamic approach. To evaluate our system, a laboratory experiment was conducted and the results showed that the proposed system is able to detect human-based attacks on text-based CAPTCHAs effectively with a 100% detection rate. This is an open access article under the terms of the Creative Commons Attribution License, which permits use, distribution and reproduction in any medium, provided the original work is properly cited.

A Survey on Adversarial Perturbations and Attacks on CAPTCHAs

“…-CAPTCHA-solving services that employ human users (e.g., [45]) are still an attack to adversarial CAPTCHAs, since CAPTCHAs are designed to be recognized by humans. Despite the fact that a recent study in [2] proposed a CAPTCHA system against human-based attacks by exploiting the keystroke dynamics authentication system, this should be investigated in the context of adversarial CAPTCHA schemes.…”

“…CAPTCHAs may come in different forms, including video-based, text-based and imagebased CAPTCHAs. For example, the text-based CAPTCHA prompts users to recognize a text, a task that state-of-the-art text recognition programs cannot complete successfully; due to its various advantages, this form of CAPTCHA is the most commonly deployed type used by websites to date [2].…”

Investigation of Using CAPTCHA Keystroke Dynamics to Enhance the Prevention of Phishing Attacks

“…[39], in which the authors investigated a number of studies on anomaly detection using authentication via keystroke dynamics, wherein they observed that a text length of 10 characters was typical in keystroke dynamics authentication. This text length has proved to be effective when applied with a text-based CAPTCHA to detect attacks from humans [40]. However, the proposed system asks the user to solve a CAPTCHA seven times.…”

“…The number of participants and their division into groups was very similar to the method adopted in most of the previous studies, for example, study of Ref. [40]. Thus, the results of these studies were all considered to be equally credible.…”

“…proved to be effective when applied with a text-based CAPTCHA to detect attacks from humans [40]. However, the proposed system asks the user to solve a CAPTCHA seven times.…”